United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
I nilid Stall-, Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 



APPLICATION NO. 



I0/H24.273 



FILING DATE 



04/14/2004 



21912 7590 12/23/2009 

VAN PELT, YI & JAMES LLP 
10050 N. FOOTHILL BLVD #200 
CUPERTINO, CA 95014 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. CONFIRMATION NO. 



1RUONG. 1'HANHNGAB 



PAPER NUMBER 



DELIVERY MODE 



Please find below and/or attached an Office communication concerning this application or proceeding. 

The time period for reply, if any, is set in the attached communication. 



PTOL-90A (Rev. 04/07) 



l/ffflrC? nVrliUli Otfff Iff ids y 


Application No. 

10/824,273 


Applicant(s) 

HALL, ARON 


Examiner 

THANHNGA B. TRUONG 


Art Unit 

2438 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 04 September 2009 . 
2a )^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-25 and 29-31 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-25 and 29-31 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1) D Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5 ) □ Notice of Informal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 

'TOL-326 (Rev. 08-06) Office Action Summary Part of Paper No./Mail Date 20091219 



Application/Control Number: 10/824,273 
Art Unit: 2438 



Page 2 



DETAILED ACTION 

1. Applicant's arguments filed on September 4, 2009 has been entered. 
Claims 1-25 and 29-31 are pending. Claim 26-28 is canceled by the applicant. At this 
time, claims 1-25 and 29-31 are rejected. 

Response to Arguments 

2. Applicant's arguments filed September 4, 2009, under claim objection, 
have been fully considered, and they are persuasive. 

Applicant's arguments filed September 4, 2009, under 35 USC 101, have 
been fully considered, but they are not persuasive. 

As mentioned in the previous office action, although claim 22 has 
"storage" language, it does not proof to be statutory, since this term "computer-readable 
storage medium" does not support anywhere in the specification, which could construe 
as new matter. Therefore, claim 22 is still found non-statutory. In addition, the 
specification still recites a propagated signal (see paragraph [0012] of page 4 of 
specification), wherein the computer program product could embodied and transferred 
via a propagated signal. Therefore, the 101 rejection is still maintained. 

Claims 23-27 are depended on claim 22, thus they are rejected with the 
same rationale applied against claim 22 above. 

Claims 10 and 16 are also non-statutory. While thee claims recite a series 
of steps or acts to be performed, a statutory "process" under 35 U.S.C. § 101 must (1) 
be tied to a particular machine, or (2) transform underlying subject matter (such as an 
article or material) to a different state or thing. See page 10 of In Re Bilski 88 USPQ2d 
1385. Specifically, claim 10 recites "a network security method comprising: determining 
one or more quantities... calculating security protection....", but nowhere in the claim 
does it state what particular apparatus does (or is positively tied with) these series of 
steps. Because the instant claim is neither positively tied to a particular machine that 
accomplishes the claimed method steps nor transforms underlying subject matter of the 
claim to a different state or thing, the claim therefore does not qualify as a statutory 
process under 35 U.S.C. § 101. 
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As to dependent claims 11-15 and 17-21, they are rejected under 35 
U.S.C. § 101 for depending upon the non-statutory subject matter recited by 
independent claim 10 and 16, respectively. 

Applicant's arguments filed September 4, 2009, under 35 USC 112, have 
been fully considered, but they are not persuasive. 

Claim 16 is rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

The claim limitations in claim 16 uses the phrase "means for" or "step for", 
but it is modified by some structure, material, or acts recited in the claim. It is unclear 
whether the recited structure, material, or acts are sufficient for performing the claimed 
function which would preclude application of 35 U.S.C. 112, sixth paragraph, because it 
is unclear whether the recited structure is sufficient for performing the claimed function. 
In this situation, it is unclear the recited structure in the claim would preclude application 
of 112, 6th (failing the 3rd prong of the analysis). 

If applicant wishes to have the claim limitation treated under 35 U.S.C. 
112, sixth paragraph, applicant is required to amend the claim so that the phrase 
"means for" or "step for" is clearly not modified by sufficient structure, material, or acts 
for performing the claimed function. 

If applicant does not wish to have the claim limitation treated under 35 
U.S.C. 112, sixth paragraph, applicant is required to amend the claim so that it will 
clearly not be a means (or step) plus function limitation (e.g., deleting the phrase 
"means for" or "step for"). 

Applicant's arguments filed September 4, 2009, under 35 USC 102 and 
103, have been fully considered, but they are not persuasive. 
Applicant argues that: 

Applicants are unable to locate in that portion of Liang, any mention of 
"quantifying" - e.g., "determining one or more quantities" of- damages avoided as 
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recited in independent Claims 1, 10, 16, and 22. Instead, that portion of Liang appears 
to recite a process for determining whether a virus is present by examining modified 
files. 

Examiner respectfully disagrees with the applicant and still maintains that: 
Liang's Figure 4 and 5 disclose the determining step of 1402 and 1502 
showing a possible file has been modified or damage. In addition, Liang's system and 
method for effectively managing damage caused by a computer virus epidemic in a 
network environment by effectively and rapidly distributing antivirus protection and cure 
measures within the network so as to optimally reduce the level of damage during 
the virus epidemic (emphasis added) (column 2, lines 28-33 of Liang). 
Furthermore, Liang teaches a further embodiment according to the invention for finding 
a virus is by searching the modification sections in files of the network system. Initially, 
the system finds a modified file in a predetermined time interval. The system then 
determines a first plurality of modified sections of the modified file. The system finds a 
second modified file in the predetermined time interval. Next, the system determines a 
second plurality of modified sections in the second file. The system compares the first 
modified file against the second modified file. The process is repeated for other files 
being modified in the predetermined time period. The management server receives info 
on the conditions of the virus infection. If no virus is found, i.e., all the modified sections 
from different modified files are not identical nor similar, then the process comes to the 
end. Otherwise, the management server is informed that there is possibly attack a virus 
is when modified sections from different modified files are identical or similar. The 
system accordingly quarantine an area containing device nodes having files with the 
modified sections. Finally, the system transfers an antivirus task into said the 
quarantine area for finding and eradicating the virus (column 2, line 66 through column 
3, line 19 of Liang). Therefore, Liang, alone, could anticipate the newly amended 
limitation of claim 1. 

The fact that Examiner may not have specifically responded to any particular arguments 
made by Applicant and Applicant's Representative, should not be construed as 
indicating Examiner's agreement therewith. 
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For the above reasons, it is believed that the rejections should be 

sustained. 

Claim Rejections - 35 USC §112 

3. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

4. Claims 29-31 are rejected under 35 U.S.C. 112, first paragraph, as failing 
to comply with the written description requirement. The claim(s) contains subject matter 
which was not described in the specification in such a way as to reasonably convey to 
one skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. 

Claim 29 recites the language "determining a monetary value associated 
with the damages avoided." These languages of "determining a monetary value" does 
not support by the specification. Appropriate correction is required. 

Claim 30 recites the language "determining a first portion of damages...." 
These languages of "determining a first portion" does not support by the specification. 
Appropriate correction is required. 

Claim 31 recites the language "determining a count of the one ore more 
blocked attacks." These languages of "determining a count" does not support by the 
specification. Appropriate correction is required. 

5. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

6. Claim 16 are rejected under 35 U.S.C. 112, second paragraph, as being 
incomplete for omitting essential structural cooperative relationships of elements, such 
omission amounting to a gap between the necessary structural connections. See 
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MPEP §2172.01. The omitted structural cooperative relationships are: component or 
unit or module wherein claim element is a means (or step) plus function that invokes 35 
U.S.C. 112, sixth paragraph. However, written description fails to clearly link or 
associate the disclosed structure, material, or acts to the claimed function such that one 
of ordinary skill in the art would recognize what structure, material, or acts perform the 
claimed invention. Thus, these essential missing component or unit or module is 
important and necessary to connect its relationship with the step of processing. 
Appropriate correction is required. 

Claims 17-21 have limitation that are similar to those of claim 16, thus it is 
rejected with the same rationale applied against claim 16 above. 

Claim Rejections - 35 USC § 101 

7. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

8. Claims 10-27 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

a. Referring to claim 22: 

Claim 22 recites "a computer program embodied in a computer- 
readable storage medium, and comprising computer instructions for: quantifying 
damages avoided by one or more blocked attacks; and calculating security protection 
consumption during a period of time." It appears that any digital or analog signal can be 
transmitted to recordable type media to be stored thereon which direct the claims signal 
per se, therefore, claim 22 is non-statutory. In addition, the claim is clearly a software 
program and it is non-statutory as not being tangibly embodied in a manner so as to be 
executable. Furthermore, applicant has pointed out in the specification (paragraph 
[0012] of page 4) that the computer readable medium may comprise a disk, a device, 
and/or a propagated signal, which clearly including intangible media such as signals, 
carrier waves, transmissions, optical waves, transmission media or other media 
incapable of being touched or perceived absent the tangible medium through which they 
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are conveyed. Therefore, claim 22 recites a non-statutory subject matter. Appropriate 
correction required. See MPEP 2106. 

Claims 23-27 are depended on claim 22, thus they are rejected with 
the same rationale applied against claim 22 above. 

b. Referring to claim 10: 

i. This claim has limitations that is similar to those of claim 22, thus it 
is rejected with the same rationale applied against claim 22 above. 

Claims 11-15 are depended on claim 10, thus they are rejected with 
the same rationale applied against claim 10 above. 

c. Referring to claim 16: 

i. This claim has limitations that is similar to those of claim 22, 
thus it is rejected with the same rationale applied against claim 22 above. 

Claims 17-21 are depended on claim 16, thus they are 
rejected with the same rationale applied against claim 16 above. 

Claim Rejections - 35 USC § 102 

9. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

10. Claims 1-27 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Liang (US 7,062,553 B2). 

a. Referring to claim 1: 

i. Liang teaches a system comprising: 
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(1) a processor (column 4, line 29 of Liang); and a 
memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions (column 8, lines 38-44 of Liang) which when executed 
cause the processor to: determining one or more quantities of damages avoided by one 
or more blocked attacks (see Figure 4, element 1402 and Figure 5, element 1502; 
column 2, line 66 through column 3, line 19; and column 7, line 66 through 
column 8, line 4 of Liang); and calculate security protection consumption during a 
period of time (see abstract; column 2, lines 34-44; column 11, lines 7-20 of Liang). 

b. Referring to claim 2: 

i. Liang further teaches: 

(1) wherein determining one or more quantities damages 
includes determining whether a blocked attack would have exploited a network 
vulnerability (see Figure 4, element 1402 and Figure 5, element 1502; column 9, 
lines 1-11 of Liang). 

c. Referring to claim 3: 

i. Liang further teaches: 

(1) wherein determining whether a blocked attack would 
have exploited network vulnerability includes replaying the attack on an internal network 
(e.g., LAN) (column 9, lines 1-11 of Liang). 

d. Referring to claim 4: 

i. Liang further teaches: 

(1) further comprising a scanner configured to scan one 
or more devices for vulnerabilities (column 10, lines 22-31 and 51-63 of Liang). 

e. Referring to claim 5: 

i. Liang further teaches: 

(1) wherein the scanner is configured to quantify the risk 
of one or more devices (column 11, lines 7-20 of Liang). 

f. Referring to claim 6: 
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i. Liang further teaches: 

(1) wherein the scanner is located within a customer 
network (column 10, lines 51-63 of Liang). 

g. Referring to claim 7: 

i. Liang further teaches: 

(1) further comprising an intrusion suppression module 
configured to block attacks (column 2, lines 40-44; column 7, line 66 through 
column 8, line 2 of Liang). 

h. Referring to claim 8: 

i. Liang further teaches: 

(1) wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time 
(column 6, lines 56-67; column 2, lines 34-44; column 11, lines 7-20 of Liang). 

i. Referring to claim 9: 

i. Liang further teaches: 

1) wherein the intrusion suppression module is located 
outside (e.g., remote location) a customer network (column 9, lines 5-7 of Liang). 

j. Referring to claims 10-15: 

i. These claims consist a network security method to 
implement from the network security apparatus of claim 1, thus they are rejected with 
the same rationale applied against claims 1-9 above. 

k. Referring to claims 16-21: 

i. These claims have limitations that are similar to those of 
claims 1-9, thus they are rejected with the same rationale applied against claims 1-9 
above. 

I. Referring to claims 22-27: 

i. These claims consist a computer program stored on a 
computer-readable storage medium to implement by the network security method of 
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claim 10 from the system of claim 1, thus they are rejected with the same rationale 
applied against claims 1-9 above. 

Claim Rejections - 35 USC § 103 

1 1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

12. Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Liang (US 7,062,553 B2), and further in view of Colson et al (US 2003/0128229). 

a. Referring to claim 1: 

i. Liang teaches a system comprising: 

(1) a processor (column 4, line 29; column of Liang); and 
a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions (column 8, lines 38-44 of Liang) which when executed 
cause the processor to: determining one or more quantities of damages avoided by one 
or more blocked attacks (see Figure 4, element 1402 and Figure 5, element 1502; 
column 2, line 66 through column 3, line 19 of Liang); and calculate security 
protection consumption during a period of time (see abstract; column 2, lines 34-44; 
column 11, lines 7-20 of Liang). 

ii. Although Liang teach the processor, memory as shown in 
column 8, lines 38-44, Liang does not clearly mention that memory is coupled or 
associated with CPU or processor to execute the program task (if indeed is not 
inherently). However, Gupta clearly teaches this limitation in Figure 3 and more detail 
on column 4, lines 7-13 of Gupta. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 
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(1) modified the invention of Liang (if indeed is not 
inherently) with the teaching of Gupta to execute the program for antivirus control in a 
network system and, more particularly, damage control against virus outbreak in a 
network environment with a plurality of device nodes under malicious code attack 
(column 1 , lines 1 5-1 8 of Liang). 

iv. The ordinary skilled person would have been motivated to: 

(1) modified the invention of Liang (if indeed is not 
inherently) with the teaching of Gupta for effectively executing the program for 
managing damage caused by a computer virus epidemic in a network environment by 
effectively and rapidly distributing antivirus protection and cure measures within the 
network so as to optimally reduce the level of damage during the virus epidemic 
(column 2, lines 29-33 of Liang). 

b. Referring to claim 2: 

i. Liang further teaches: 

(1) wherein determining one or more quantities damages 
includes determining whether a blocked attack would have exploited a network 
vulnerability (see Figure 4, element 1402 and Figure 5, element 1502; column 9, 
lines 1-11 of Liang). 

c. Referring to claim 3: 

i. Liang further teaches: 

(1) wherein determining whether a blocked attack would 
have exploited network vulnerability includes replaying the attack on an internal network 
(e.g., LAN) (column 9, lines 1-11 of Liang). 

d. Referring to claim 4: 

i. Liang further teaches: 

(1) further comprising a scanner configured to scan one 
or more devices for vulnerabilities (column 10, lines 22-31 and 51-63 of Liang). 

e. Referring to claim 5: 
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i. Liang further teaches: 

(1) wherein the scanner is configured to quantify the risk 
of one or more devices (column 11, lines 7-20 of Liang). 

f. Referring to claim 6: 

i. Liang further teaches: 

(1) wherein the scanner is located within a customer 
network (column 10, lines 51-63 of Liang). 

g. Referring to claim 7: 

i. Liang further teaches: 

(1) further comprising an intrusion suppression module 
configured to block attacks (column 2, lines 40-44; column 7, line 66 through 
column 8, line 2 of Liang). 

h. Referring to claim 8: 

i. Liang further teaches: 

(1) wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time 
(column 6, lines 56-67; column 2, lines 34-44; column 11, lines 7-20 of Liang). 

i. Referring to claim 9: 

i. Liang further teaches: 

1) wherein the intrusion suppression module is located 
outside (e.g., remote location) a customer network (column 9, lines 5-7 of Liang). 

Conclusion 

13 Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is filed 
within TWO MONTHS of the mailing date of this final action and the advisory action is 
not mailed until after the end of the THREE-MONTH shortened statutory period, then 
the shortened statutory period will expire on the date the advisory action is mailed, and 
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any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date 
of the advisory action. In no event, however, will the statutory period for reply expire 
later than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Thanhnga (Tanya) Truong whose telephone number 
is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Taghi Arani can be reached at 571-272-3787 The fax and phone 
numbers for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Any inquiry of a general nature or relating to the status of this application 
or proceeding should be directed to the receptionist whose telephone number is 571- 
272-2100. 



/Thanhnga B. Truong/ 

Primary Examiner, Art Unit 2438 

TBT 

December 19, 2009 
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